Tucked away in a single paragraph near the end of the declassified preliminary report on the failed Christmas Day terrorist attack is the key fact glossed over by most in media and the government: Umar Farouk Abdulmutallab had a valid visa when he boarded his Detroit-bound flight.

The reason is simple: the State Department insists that “possible” and even “suspected” terrorists deserve visas. Denials and revocations are reserved only for known terrorists.

Whether or not “dots” had been “connected,” Abdulmutallab never could have come as close as he did to successful mass murder had the State Department immediately revoked his visa when his father warned U.S. officials about his son’s terrorist ties. Without a valid visa, the young Nigerian would not have been en route to the U.S. in the first place.

All the more maddening is that this is precisely the lesson we learned from the 9/11 terrorists, none of whom actually qualified for the visas that were nonetheless issued to them. Yet eight years later, the State Department has barely budged its default position that visas are to be issued unless they have a clear reason to deny applications.

Even though Abdulmutallab’s father told U.S. Embassy officials on November 18 that he feared that his son might have terrorist intentions, the al Qaeda operative retained his privilege to enter the U.S.

While the initial visa issuance to Abdulmutallab might well have been legitimate—he is, after all, well-educated and from a successful family—the fact that his visa was not immediately revoked is beyond baffling.

Although a misspelling of the young Nigerian’s name prevented State from identifying his still-valid visa, the report further notes that the father’s warnings would not have been sufficient cause to rescind it. According to the report, “A determination to revoke his visa, however, would have only occurred if there had been a successful integration of intelligence by the CT community, resulting in his being watchlisted.”

This suicidally legalistic approach does not owe to Obama or previous political leadership, but rather to the long-held institutional mindset of the State Department. Using a deeply flawed legal interpretation, State’s position has been that a visa must be issued to qualified applicants, with denials only possible with specific, credible proof that someone can be deemed a security threat.

But unlike in a court of law, foreigners wishing to enter the U.S. should not be presumed innocent. Moreover, denial of the privilege to come to the U.S. is not reviewable, and it can be made unilaterally by State. Yet it is State who pushes to issue visas to those who raise red flags, but don’t quite belong on the terrorist watchlist.

The Department of Homeland Security, which holds partial regulatory authority over visa policy, has had running battles with State over visa issuance. Law enforcement-minded DHS officials believe in erring on the side of security, while State again and again has sided with foreigners seeking access to the U.S.

As part of this larger power struggle, DHS has been thwarted in many of its attempts to open Visa Screening Units (VSUs), which were mandated for every visa-issuing post as part of the Homeland Security Act of 2002. Nearly eight years later, there are only 14 VSUs, or just over 10% of all embassies and consulates. There is no VSU in Nigeria, even though DHS has wanted to establish one.

Lack of funding is partly to blame, but several Ambassadors have successfully rebuffed efforts to create VSUs in their countries—fearing that enhanced security enforcement would slow visa processing, angering local government officials.

State shouldn’t need encouragement to understand the crucial role of visas for foreign terrorists who wish to strike on U.S. soil. As we learned from the 9/11 report, al Qaeda wasn’t even able to recruit 30 operatives for 9/11. Their good fortune—and our tragedy—was that they recruited mostly in Saudi Arabia, a country which enjoyed 98% visa approval rates before 9/11.

What the 9/11 Commission acknowledged—but strangely shrugged off as insignificant—was that not one of the terrorists whose applications could be reviewed after the attack actually qualified for the visas that they all received. (Four of the application forms were destroyed by regular policy before 9/11.) In other words, had the visa law been followed, at least 15 of the terrorists wouldn’t have gained entry to the U.S. in order to carry out the attacks.

Yet with that painful history, State’s sole response to the warnings from Abdulmutallab’s father was to “nominate” the young Muslim fanatic for inclusion on the terrorist watchlist.

While it is welcome that President Obama has ordered a review of “visa issuance and revocation criteria,” a more decisive step must be taken.

Any probable cause of terrorist connections needs to result in visa denials and revocations unless the evidence can be disproved or reasonably deemed illegitimate. Even when we have no specific information, as was the case with most of the 9/11 terrorists, State should enforce the visa laws as strictly with young Muslim men from known terrorist hotspots as it does with, say, poor (or even middle-class) Filipinos.

But for State to enforce existing law and err on the side of security, the department must undergo a complete about-face from its current operating procedures. If President Obama is as serious as he claims to be, however, he must demand nothing less.